release-please.yml

name: release-please

# Maintains a standing "Release PR" that accumulates feat:/fix:/deps: commits
# since the last release into a version bump + changelog (release-please-config.json
# controls which commit types count and where they land in CHANGELOG.md). Every
# push to main updates that one PR in place rather than opening a new one.
#
# The auto-merge step below merges that PR itself the moment required CI passes
# (same pattern as dependabot-auto-merge.yml), so a qualifying change on main
# becomes a tagged release with no manual version bump or `git tag` needed. That
# merge is what actually cuts the release: release-please creates the git tag +
# GitHub Release, which triggers release.yml's tag-triggered image publish
# (pinned :X.Y.Z / :X.Y images).
#
# Want a manual gate instead (open the PR, but decide yourself when to ship)?
# Delete the "Auto-merge the release PR" step below — everything else still
# works, you just click Merge on the PR when you're ready.
on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write
  # Needed to dispatch release.yml for pinned-image builds (see below).
  actions: write

concurrency:
  group: release-please
  cancel-in-progress: false

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      - uses: googleapis/release-please-action@v5
        id: release

      # release-please's commits (both the initial PR and every amend as more
      # feat:/fix: land on main) are made with GITHUB_TOKEN, so ci.yml's
      # `push`/`pull_request` triggers never fire for them — same suppression
      # as the tag case below. Without this, the release PR sits with no
      # required checks and `gh pr merge --auto` never actually completes.
      # workflow_dispatch is exempt, so dispatch CI against the release
      # branch's current head explicitly, every time the PR is touched.
      - name: Run CI on the release PR
        if: steps.release.outputs.pr != ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_JSON: ${{ steps.release.outputs.pr }}
        run: |
          PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')
          HEAD_REF=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json headRefName -q .headRefName)
          gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$HEAD_REF"

      - name: Auto-merge the release PR once it's open
        if: steps.release.outputs.prs_created == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_JSON: ${{ steps.release.outputs.pr }}
        run: |
          PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')
          gh pr merge --auto --squash --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" \
            || echo "Auto-merge not enabled — turn on 'Allow auto-merge' in repo settings, or merge #$PR_NUMBER manually."

      # Tags created here use GITHUB_TOKEN, and GitHub suppresses workflow
      # triggers for events made with that token — release.yml's `tags:`
      # trigger never fires for them. workflow_dispatch is exempt from that
      # suppression, so kick the pinned-image build explicitly.
      - name: Build pinned images for the new tag
        if: steps.release.outputs.release_created == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.release.outputs.tag_name }}
        run: gh workflow run release.yml --repo "$GITHUB_REPOSITORY" -f tag="$TAG"